Spyware Warrior

[OldOnliner]

You might be interested in my recent blog entry. It's something I stumbled upon while looking at latest blogs list at Blogger.com this morning.

My blog about it is here:

http://www.geocities.com/mark_e_p/blog.html

And this is what it says:

[olliver]

Interesting post, because it demonstrates a weakness in Blogger's code that could be easily expoited for malicious purposes:
When someone is writing an article, the headline apparently isn't stripped from any html tags. In connection with a free blogging service, an environement that can't be immediately controlled and trusted, people shouldn't have any opportunity to use html tags at all (similar to this forum here). Even worse, since html tags aren't filtered, one could implement Javascript events like onLoad or onClick, that would redirect users via document.location to whereever the spammers wants them to be. This could be an affiliate but also an exploit laden site that will hit them with malware. I've just reported the site to Blogger's abuse team and notified them of the possible js-exploit on that occasion.

Btw: His latest post provoked the feedback of a comment spammer. A spammer getting spammed by another spammer, now that's what I call irony

Olliver